dependency-check / dependency-check/DependencyCheck
CENTRAL - NODEAUDIT - POM Cached results never expire
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Precondition**
- [X] I checked the issues list for existing open or closed reports of the same problem.
**Describe the bug**
When caches are activated for CENTRAL - NODEAUDIT and POM, results are cached but with the internal flag isEternal set to true.
**Version of dependency-check used**
The problem occurs using version 13.0.0 of the maven plugin, but it affects the core module
**Log file**
**To Reproduce**
Steps to reproduce the behavior:
1. Run a first dependency check, on a module containing node module and specially file package-lock.json, with default configuration. Cache should be created, in folder org/owasp/dependency-check-data/11.0/cache under maven respository
2. Wait 24h and expect there is new vulnerability on the module
3. Run again the check
4. The new vulnerability is not thrown
**Expected behavior**
Cache results should expire after the configuration time
**Additional context**
Difficult to check with log file or module, as it depends on known vulnerabilities.
The error is in the file dependencycheck-cache.properties
This will apply to "default" configuration
```
jcs.default.elementattributes.IsEternal=false
```
But the configuration is not set on region CENTRAL - POM - NODEAUDIT
But in the lib commons-jc3-core lib, default values are not applied as default value on region configuration. It is used when the configuration for the region does not provide the key jcs.region..elementattributes, usually with value org.apache.commons.jcs3.engine.ElementAttributes.
A temporary fix for the moment is to add a system variable in Maven command, like
```
-Djcs.region.CENTRAL.elementattributes.IsEternal=false
-Djcs.region.POM.elementattributes.IsEternal=false
-Djcs.region.NODEAUDIT.elementattributes.IsEternal=false
```
But if caches already contain result, the eternal flag is already set to true in cached result. Arguments from command line do not solve the issue.
Second solution, update the file dependencycheck-cache.properties with:
```
jcs.region.CENTRAL.elementattributes.IsEternal=false
jcs.region.POM.elementattributes.IsEternal=false
jcs.region.NODEAUDIT.elementattributes.IsEternal=false
```
But it will need to delete the existing cache, for the same reason as previous fix.
Contributor guide
Assessment
This issue has not been assessed yet.